AWS KMS Signing

For SDK requirements and common imports, see Digital Signatures.

CPDFAwsKmsSigner signs a saved PDF through an AWS KMS key. The signing private key stays with KMS. The application supplies the KMS configuration and a signer certificate whose public key matches that key.

The current direct binding supports an RSA KMS key of at least 2048 bits and RSASSA_PKCS1_V1_5_SHA_256. Other signing algorithms are rejected. Its endpoint must be a root HTTPS URL without an explicit port, extra path, query, or fragment.

The direct binding requires explicit access-key credentials. It does not automatically use the AWS default credential provider chain. Temporary credentials with a nonempty session token are currently rejected with sdk.kms.session_token_unsupported.

Load credentials from your application's configuration. Do not place real secret keys in source code or logs.

Files.createDirectories(Paths.get("output"));
CPDFAwsKmsConfig kms = new CPDFAwsKmsConfig()
        .setEndpoint("https://kms.us-east-1.amazonaws.com")
        .setRegion("us-east-1")
        .setKeyId("YOUR_KMS_KEY_ID_OR_ARN")
        .setCredentials(
                System.getenv("AWS_ACCESS_KEY_ID"),
                System.getenv("AWS_SECRET_ACCESS_KEY"),
                "")
        .setSigningAlgorithm("RSASSA_PKCS1_V1_5_SHA_256")
        .setCertificate(
                Files.readAllBytes(Paths.get("certs/kms-signer.der")),
                new byte[][] {Files.readAllBytes(Paths.get("certs/kms-issuer.der"))});

CPDFSignatureOptions options = new CPDFSignatureOptions()
        .setFieldName("KmsSignature")
        .setVisible(false)
        .setValidationOptions(new CPDFSignatureValidationOptions()
                .setTrustedCertPath("certs/trusted-roots.pem"));
CPDFSignatureCreateResult result = CPDFAwsKmsSigner.sign(
        "input.pdf", "output/kms-signed.pdf", options, kms);
System.out.println("Creation success: " + result.isSuccess());
System.out.println(Arrays.toString(result.getErrors()));
System.out.println(result.getValidationResult());

Use DER-encoded signer and chain certificates. The output must be new, different from the input, and have an existing parent directory. Creation success is separate from signature validation and trust.

Fetch a Public Key or Generate a CSR

getPublicKey() returns DER-encoded X.509 SubjectPublicKeyInfo. generateCsr() returns a signed PKCS#10 request in DER; submit it to a CA to obtain a certificate. Neither method exports the private key or issues a CA certificate.

Using the kms configuration from the previous example:

CPDFKmsDataResult publicKey = CPDFAwsKmsSigner.getPublicKey(kms);
if (publicKey.isSuccess()) {
    Files.write(Paths.get("output/kms-public-key.der"), publicKey.getData());
}

kms.setCommonName("Example PDF Signing Key");
CPDFKmsDataResult csr = CPDFAwsKmsSigner.generateCsr(kms);
if (csr.isSuccess()) {
    Files.write(Paths.get("output/kms-signer.csr.der"), csr.getData());
}

The current CPDFAwsKmsSigner.sign() creates an ordinary detached PKCS#7 signature. It does not create PAdES attributes, embedded signature timestamps, or LTV evidence. signPades() currently returns sdk.kms.pades_unsupported without contacting KMS or creating a PDF.

Adding a document timestamp or calling LTV prolongation is not, by itself, a guarantee that an ordinary KMS signature satisfies LT/LTA. Inspect the profile reports. When an external signing service manages KMS and supplies a complete CMS container, use the external container or two-phase APIs; the Java client does not need that service's internal KMS credentials.